CVE-2026-96940

Microsoft Exchange Server Elevation of Privilege Vulnerability

Published Oct 2, 2026 CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed

Description

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft Exchange Server 2016 Cumulative Update 23

affected

Version	Status	Constraints
`15.01.0.0`	affected	< 15.01.2507.075

Microsoft

Microsoft Exchange Server 2019 Cumulative Update 14

affected

Version	Status	Constraints
`15.02.0.0`	affected	< 15.02.1544.048

Microsoft

Microsoft Exchange Server 2019 Cumulative Update 15

affected

Version	Status	Constraints
`15.02.0.0`	affected	< 15.02.1748.053

Microsoft

Microsoft Exchange Server Subscription Edition RTM

affected

Version	Status	Constraints
`15.02.0.0`	affected	< 15.02.2562.053

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23::::::
	cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14::::::
	cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15::::::
	cpe:2.3:a:microsoft:exchange_server_subscription_edition::::::::

No data.

Vendor Product Versions

Microsoft

Microsoft Exchange Server 2016 Cumulative Update 23

Version	Status	Scheme	Platform
`[15.01.0.0,15.01.2507.075)`	affected	generic	['x64-based_systems']

Microsoft

Microsoft Exchange Server 2019 Cumulative Update 14

Version	Status	Scheme	Platform
`[15.02.0.0,15.02.1544.048)`	affected	generic	['x64-based_systems']

Microsoft

Microsoft Exchange Server 2019 Cumulative Update 15

Version	Status	Scheme	Platform
`[15.02.0.0,15.02.1748.053)`	affected	generic	['x64-based_systems']

Microsoft

Microsoft Exchange Server Subscription Edition Rtm

Version	Status	Scheme	Platform
`[15.02.0.0,15.02.2562.053)`	affected	generic	['x64-based_systems']

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.7% (2.749% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940

History

Oct 15, 2026 2:45 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft exchange Server Microsoft exchange Server Subscription Edition
CPEs		cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:::::: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:::::: cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15:::::: cpe:2.3:a:microsoft:exchange_server_subscription_edition::::::::
Vendors & Products		Microsoft exchange Server Microsoft exchange Server Subscription Edition

Oct 13, 2026 7:15 PM Description updated View changes

Type	Values Removed	Values Added
Description	An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests. Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker.	Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Oct 8, 2026 10:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.	An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests. Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker.

Oct 2, 2026 10:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft microsoft Exchange Server 2016 Cumulative Update 23 Microsoft microsoft Exchange Server 2019 Cumulative Update 14 Microsoft microsoft Exchange Server 2019 Cumulative Update 15 Microsoft microsoft Exchange Server Subscription Edition Rtm
Vendors & Products		Microsoft microsoft Exchange Server 2016 Cumulative Update 23 Microsoft microsoft Exchange Server 2019 Cumulative Update 14 Microsoft microsoft Exchange Server 2019 Cumulative Update 15 Microsoft microsoft Exchange Server Subscription Edition Rtm

Oct 2, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 2, 2026 7:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
Title		Microsoft Exchange Server Elevation of Privilege Vulnerability
First Time appeared		Microsoft Microsoft exchange Server 2016 Microsoft exchange Server 2019 Microsoft exchange Server Se
Weaknesses		CWE-1390
CPEs		cpe:2.3:a:microsoft:exchange_server_2016::cumulative_update_23::::::* cpe:2.3:a:microsoft:exchange_server_2019::cumulative_update_14::::::* cpe:2.3:a:microsoft:exchange_server_2019::cumulative_update_15::::::* cpe:2.3:a:microsoft:exchange_server_se::RTM::::::*
Vendors & Products		Microsoft Microsoft exchange Server 2016 Microsoft exchange Server 2019 Microsoft exchange Server Se
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Earlier changes (1)

Subscriptions

Microsoft Exchange Server Exchange Server 2016 Exchange Server 2019 Exchange Server Se Exchange Server Subscription Edition Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 14 Microsoft Exchange Server 2019 Cumulative Update 15 Microsoft Exchange Server Subscription Edition Rtm

Weaknesses